Systems and methods for managing faults in a network

ABSTRACT

A system ( 130 ) improves network management. The system ( 130 ) associates an event in the network with a network device and provides a geographical map ( 710 ). The geographical map ( 710 ) displays locations of network devices and indicates which network devices are associated with at least one event.

FIELD OF THE INVENTION

The present invention relates generally to networks and, moreparticularly, to systems and methods for improving network management.

BACKGROUND OF THE INVENTION

Presently, the act of troubleshooting a network is a time-consumingtask. Several solutions exist that aid network administrators inmanaging faults in a network by providing various tools for collectingand viewing individual faults (i.e., alarms) and performing a set ofoperations on them (e.g., acknowledge, clear, escalate, etc.).Typically, these views are variations on tabular displays (i.e., rows ofalarms) and two-dimensional (2D) topology displays (i.e., network maps).

These tools are generally adequate for small-to-medium scale networkoperation centers, such as network operation centers with less than 100alarms/per shift/per monitoring technician, moderate requirements on thefrequency of network upgrades, etc. In environments with a large numberof network elements and high alarm rates, however, these tools are oftenlimited with respect to their ability to display relevant, real-time,fault information to monitoring technicians and network operationcenter's management. These limitations often invalidate the use ofavailable tools in support of large-scale network operations.

Therefore, there exists a need for systems and methods that facilitatethe management of a network.

SUMMARY OF THE INVENTION

A system and method consistent with the present invention address thisand other needs by providing a mechanism that facilitates networkmanagement.

In accordance with the purpose of the invention as embodied and broadlydescribed herein, a method for managing a network includes providing afirst list of events occurring in the network; simultaneously providinga second list of events occurring in the network, the second listcomprising a predetermined number of most recent events; and managingthe network using the first and second lists.

In another implementation consistent with the present invention, adevice for managing a network having a plurality of network elementsincludes a memory and a processor. The processor provides a list ofidentifiers associated with the plurality of network elements, whereeach network element identifier is associated with a state indication.

In yet another implementation consistent with the present invention, amethod for managing a network having a plurality of network devicesincludes associating events in the network with one of the plurality ofnetwork devices; providing a geographical map, the geographical mapdisplaying locations of each of the plurality of network devices andindicating which of the plurality of network devices are associated withat least one event; and managing the network using the geographical map.

In still yet another implementation consistent with the presentinvention, a device for managing a network having a plurality of networkelements includes a memory and a processor. The processor associateseach network element with one of a plurality of logical planes andprovides a network map. The network map displays relationships betweenthe plurality of logical planes and those network elements associatedwith the plurality of logical planes.

In still another implementation consistent with the present invention, asystem for managing a network having a plurality of network elementsincludes a user device and a server. The user device provides a userwith a list of network management options, the options including anetwork element diagnostic option, a network summary option, ageographical network management option, a three-dimensional networkmanagement option, transmits, in response to a selection of an option bythe user, a request for current network information, provides the userwith current network information according to the selected option. Theserver receives the request for current network information andtransmits current network information to the user device.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate an embodiment of the inventionand, together with the description, explain the invention. In thedrawings,

FIG. 1 illustrates an exemplary system in which systems and methods,consistent with the present invention, may be implemented;

FIG. 2 illustrates an exemplary server consistent with the presentinvention;

FIGS. 3A and 3B illustrate exemplary databases consistent with thepresent invention;

FIG. 4 illustrates an exemplary network operations center consistentwith the present invention;

FIGS. 5-8 illustrate exemplary graphical user interfaces, consistentwith the present invention, that facilitate network managementoperations;

FIG. 9 illustrates an exemplary process, consistent with the presentinvention, that improves management of a network; and

FIG. 10 illustrates an exemplary graphical user interface that may beprovided to the user of a network operations center.

DETAILED DESCRIPTION

The following detailed description of the invention refers to theaccompanying drawings. The same reference numbers in different drawingsidentify the same or similar elements. Also, the following detaileddescription does not limit the invention. Instead, the scope of theinvention is defined by the appended claims.

Systems and methods, consistent with the present invention, provide amechanism to improve network management. The mechanism simplifies themanner in which a user (e.g., a network engineer) analyzes the operationof the network by providing the user with several graphical userinterfaces. The graphical user interfaces allow the user to manage thenetwork in a variety of ways.

Exemplary System

FIG. 1 illustrates an exemplary system 100 in which systems and methods,consistent with the present invention, that improve management of anetwork may be implemented. In FIG. 1, system 100 includes a network110, points of presence (POPs) 112-122, a server 130, a networkoperations center (NOC) 140, and a group of nodes 161-169 that may bedirectly connected to a POP 112-122 or connected via a customer network151-153.

The network 110 may include, for example, the Internet, an intranet, alocal area network (LAN), a metropolitan area network (MAN), a wide areanetwork (WAN), or the like. In fact, the network 110 may include anytype of network or combination of networks that permits routing ofinformation from a particular source to a particular destination.

The POPs 112-122 may include conventional routers that decide, based onrouting protocols (e.g., a frame relay protocol) and routing tables, howand where to send packets of information. Each POP 112-122 may alsoinclude one or more servers, such as an e-mail server or a World WideWeb server. Each POP 112-122 may be implemented via hardware and/orsoftware.

The server 130 may include any type of computer system, such as amainframe, minicomputer, or personal computer, capable of connecting tothe network 110 to communicate with other devices, such as the networkoperations center 140, in the system 100. In alternativeimplementations, the server 130 may include a mechanism for directlyconnecting to the network operations center 140 or may be includedwithin network operations center 140. The server 130 may also include amechanism for communicating with the nodes 161-169. The server 130 maytransmit data over network 110 or receive data from the network 110 viaa wired, wireless, or optical connection.

The network operations center 140 may include any type of computersystem, such as a mainframe, minicomputer, personal computer, laptop,personal digital assistant, or the like, capable of connecting to thenetwork 110. The network operations center 140 monitors and manages theoperation of the network 110. The network operations center 140 maytransmit data over the network 110 or receive data from the network 110via a wired, wireless, or optical connection.

The customer networks 151-153 may include any type of local network,such as a LAN, MAN, WAN, or the like, that permits routing ofinformation packets among the nodes connected to the respective network.The nodes 161-169 may include computers, such as workstations andservers, or any other type of device that has a network interface card(NIC), such as a printer or modem. Moreover, the nodes 161-169 mayinclude devices, such as a personal digital assistant, that connect to aparticular local network via a wireless connection.

The number of components illustrated in FIG. 1 is provided forsimplicity. In practice, a typical system 100 may include a larger orsmaller number of networks, POPs, servers, network operations centers,customer networks, and/or nodes.

Exemplary Server Configuration

FIG. 2 illustrates an exemplary server 130 consistent with the presentinvention. The server 130 includes a bus 210, a processor 220, a memory230, an input device 240, an output device 250, and a communicationinterface 260. The bus 210 may include one or more conventional busesthat permit communication among the components of the server 130.

The processor 220 may include any type of conventional processor ormicroprocessor that interprets and executes instructions. The memory 230may include a random access memory (RAM) or another type of dynamicstorage device that stores information and instructions for execution bythe processor 220; a read only memory (ROM) or another type of staticstorage device that stores static information and instructions for useby the processor 220; and/or some other type of magnetic or opticalrecording medium and its corresponding drive.

The input device 240 may include one or more conventional mechanismsthat permit an operator to input information to the server 130, such asa keyboard, a mouse, a pen, voice recognition and/or biometricmechanisms, and the like. The output device 250 may include one or moreconventional mechanisms that output information to the operator,including a display, a printer, a speaker, etc. The communicationinterface 260 may include any transceiver-like mechanism that enablesthe server 130 to communicate with other devices and/or systems. Forexample, the communication interface 260 may include mechanisms forcommunicating with the network operations center 140 via a network, suchas network 110 (FIG. 1).

Execution of the sequences of instructions contained in memory 230causes processor 220 to provide current network information as describedbelow. In alternative embodiments, hard-wired circuitry may be used inplace of or in combination with software instructions to implement thepresent invention. Thus, the present invention is not limited to anyspecific combination of hardware circuitry and software.

The server 130, consistent with the present invention, providesinformation from one or more databases to a graphical user interface atthe network operations center 140. The database may be stored at theserver 130 (e.g., in memory 230) or externally from server 130.

FIGS. 3A and 3B illustrate exemplary databases 310 and 330,respectively, consistent with the present invention. It will beappreciated that server 130 may consist of other databases storedlocally or distributed throughout the network 110.

As illustrated, database 310 includes a group of entries 305 that relateto events that occurred in the network 110. Each entry 305 may includeinformation stored in one more of the following exemplary fields: analarm type field 311, an optional number field 312, a state field 313,an action field 314, a time field 315, a date field 316, a networkelement (NE) identifier (ID) field 317, and an alarm description field318. Database 310 may contain additional or different fields that wouldaid the server 130 in searching and sorting information in database 310.While information for a single network element (ABCDEFG03H) isillustrated in FIG. 3A, it will be appreciated that database 310 mayinclude information for more than one network element.

The alarm type field 311 may store an identifier indicating the type ofalarm associated with a network element. Typical alarms may include, forexample, a fire alarm, a port alarm, a line alarm, and the like. Thealarm type field 311 may include a subfield (not shown) that stores avariable indicative of the severity of a corresponding alarm. Alarmseverity categories might include critical, major, minor, andinformational. The optional number field 312 may store an indication ofthe number of alarms represented by a single alarm icon.

The state field 313 may store an indication, represented by one or moreletters, of the state of the alarm. For example, an “A” may represent anacknowledged alarm, an “E” may represent an escalated alarm state, an“AE” may represent an alarm that has been acknowledged and escalated,and a “C” may represent that an alarm has been cleared. The state field313 may be left blank to indicate that an alarm has not beenacknowledged, escalated, or cleared. The state field 313 may include oneor more variables to indicate that the alarms associated with a networkelement are in the same state or in different states.

The action field 314 may store an indication of the type of action takenon an alarm. For example, an indication of “PA” may represent thatactivity for this particular alarm is planned. The action field 314 maybe left blank when no action has been taken on the alarm. The time field315 may store an indication of the time that the alarm occurred. Thetime may, for example, be stored in HH:MM:SS format or some otherformat. The date field 316 may store an indication of the date that theevent occurred. The date may, for example, be stored in MM/DD/YYYYformat or some other format.

The NE ID field 317 may store an identifier of the network element onwhich the alarm occurred. The NE ID field 317 may, for example, storethe identifier as a Common Language Location Identifier (CLLI). Othertechniques for identifying the network element may alternatively beused.

The alarm description field 318 may store information describing theproblem associated with the alarm. The alarm description field 318 mayinclude, for example, an indication that a fire has been detected at aparticular network element, an identity of a particular port that hasfailed, or the like. The database 310 may also include anacknowledgement field (not shown) that stores an identifier associatedwith the user (if any) that acknowledged the alarm.

Database 330 (FIG. 3B) may include a group of entries 325 that relate toevents that occurred in the network 110. Each entry 325 may includeinformation stored in one or more of the following exemplary fields: anetwork element field 331, an ID field 332, an alarms field 333, atickets (TT) field 334, a held alarms (HA) field 335, a notes field 336,an incidents (IN) field 337, a users field 338, an escalated alarm field339, and a last modified field 340. Database 330 may include additionalor different fields that would aid the server 130 in searching andsorting information in the database 330.

The network element field 331 may store one or more identifiersrepresenting the network element type and its alarm state. A typicalnetwork element type may include, for example, a frame relay switch, anAsynchronous Transfer Mode (ATM) switch, an Internet Protocol (IP)router, or the like. The network element type may be associated with anidentifier representing the network element's alarm state. Typical alarmstates could include critical, major, minor, and informational. The IDfield 332 may store an identifier of the network element. Similar todatabase 310, the identifier may be stored as a CLLI.

The alarms field 333 may store information regarding the states of thealarms associated with a particular network element. As illustrated, thealarms field 333 may include a critical state (C) subfield, a majorstate (MA) subfield, a minor state (MI) subfield, and an informationalstate (I) subfield. The critical state, major state, minor state, andinformational state subfields may store a value indicative of the numberof alarms associated with a particular network element that is in thatparticular state. The alarms field 333 may also include a total alarmssubfield that stores a value representing the total number of alarmsassociated with a particular network element. As illustrated, thenetwork element ABCDEFG03H is associated with 130 total alarms, of which32 are critical, 35 are major, 54 are minor, and 9 are informational.

The tickets field 334 may store an indication of the number ofoutstanding trouble tickets that are associated with a network element.The held alarms field 335 may store an indication of the number ofoutstanding alarms that are on hold. The notes field 336 may store anindication of the number of outstanding notes associated with aparticular network element. The notes field 336 may also store theactual notes for the particular network element.

The incidents field 337 may store an indication of the number ofoutstanding incident reports associated with a network element. Theusers field 338 may store an indication of the number of operators thatare currently monitoring a particular network element. The escalatedalarms field 339 may store an indication of the number of escalatedalarms associated with a particular network element. The last modifiedfield 340 may store the date and time of the last time in which theinformation in fields 332-339 for a particular network element has beenmodified.

Exemplary Network Operations Center

FIG. 4 illustrates an exemplary network operations center 140 consistentwith the present invention. The network operations center 140 mayinclude a bus 402, a processor 404, a main memory 406, a ROM 408, astorage device 410, an output device 412, an input device 414, and acommunication interface 416. The bus 402 may include one or moreconventional buses that permit communication among the components of thenetwork operations center 140.

The processor 404 may include any type of conventional processor ormicroprocessor that interprets and executes instructions. The mainmemory 406 may include a RAM or another type of dynamic storage devicethat stores information and instructions for execution by the processor404. Main memory 406 may also be used to store temporary variables orother intermediate information during execution of instructions byprocessor 404.

ROM 408 may include a conventional ROM device and/or another type ofstatic storage device that stores static information and instructionsfor processor 404. The storage device 410 may include a magnetic disk oroptical disk and its corresponding drive and/or some other type ofmagnetic or optical recording medium and its corresponding drive forstoring information and instructions.

The output device 412 may include one or more conventional mechanismsthat output information to an operator, including a display, a printer,a speaker, etc. The input device 414 may include one or moreconventional mechanisms that permit the operator to input information tothe system 140, such as a keyboard, a mouse, a pen, voice recognitionand/or biometric mechanisms, etc. The communication interface 416 mayinclude any transceiver-like mechanism that enables the networkoperations center 140 to communicate with other devices and/or systems,such as the server 130. For example, the communication interface 416 mayinclude a modem or an Ethernet interface to a network. Alternatively,communication interface 416 may include other mechanisms forcommunicating via a network, such as network 110.

The network operations center 140 improves network troubleshooting inresponse to processor 404 executing sequences of instructions containedin a computer-readable medium, such as memory 406. Such instructions maybe read into memory 406 from another computer-readable medium, such as astorage device 410, or from a separate device via communicationinterface 416. A computer-readable medium may include one or morestorage devices and/or carrier waves. Execution of the sequences ofinstructions contained in memory 406 causes processor 404 to perform theprocess steps that will be described hereafter. In alternativeembodiments, hard-wired circuitry may be used in place of or incombination with software instructions to implement the presentinvention. Thus, the present invention is not limited to any specificcombination of hardware circuitry and software.

The network operations center 140, consistent with the presentinvention, provides network management information to an operator via agroup of graphical user interfaces. The graphical user interfaces may beprovided to the operator at, for example, the network operation center'soutput device 412 or at an output device located remotely therefrom.

FIGS. 5-8 illustrate exemplary graphical user interfaces, consistentwith the present invention, that facilitate network managementoperations. FIG. 5 illustrates a first exemplary graphical userinterface 500 consistent with the present invention. In FIG. 5, theexemplary graphical user interface 500 provides an active alarminterface that includes an active alarm window 505 and a most recentalarm window 510 for one or more network elements. For simplicity, theactive alarm interface 500 provides alarms associated with a singlenetwork element, namely network element ABCDEFG03H.

The active and most recent alarm windows 505 and 510 include thefollowing exemplary fields: a type field, a number (NO) field, a state(ST) field, an action (AT) field, a time field, a date field, a networkelement (NE) identifier (ID) field, a detailed alarm description field,and an acknowledge field. The type field may include an identifier, inthe form of one or more words or icons, indicating the type of alarmassociated with a network element. As illustrated, typical alarms mayinclude, for example, a fire alarm, a port alarm, a line alarm, and thelike. To illustrate the severity of a particular alarm, the identifiersmay be of different colors. For example, dark red may be used torepresent a critical alarm, red may be used to represent a major alarm,yellow may be used to represent a minor alarm, and blue may be used torepresent an informational alarm.

The number field may include an indication of the number of alarmsrepresented by a single alarm identifier in the type field. The statefield may include an indication, represented by one or more letters, ofthe state of a particular alarm. For example, an “A” may represent anacknowledged alarm, an “E” may represent an escalated alarm state, an“AE” may represent an alarm that has been acknowledged and escalated,and a “C” may represent that an alarm has been cleared. Uppercaseletters in the state field may indicate that all alarms associated witha particular network element are in the same state. Lowercase lettersmay indicate that some, but not all, of the alarms are in the specifiedstate. The state field may be left blank to indicate that an alarm hasnot been acknowledged, escalated, or cleared. It will be appreciatedthat other indications may alternatively be used.

The action field may include an indication of the type of action takenon an alarm. For example, an indication of “PA” may represent thatactivity for this particular alarm is planned. The action field may beleft blank when no action has been taken on the alarm. The time fieldmay include the time that a particular alarm occurred. The time may, forexample, be represented in HH:MM:SS format or any other format. The datefield may include the date that the alarm occurred. The date may, forexample, be represented in MM/DD/YYYY format or any other format.

The NE ID field may include an identifier of the network element onwhich the alarm occurred. The NE ID field may, for example, include theidentifier as a Common Language Location Identifier (CLLI). Othertechniques for identifying the network element may alternatively beused. If the active and most recent alarm windows 505 and 510 includeinformation for a single network element, as in FIG. 5, the NE ID fieldmay be removed.

The alarm description field may include information describing theproblem associated with a particular alarm. The alarm description fieldmay include, for example, an indication that a fire has been detected ata particular network element, an identity of a particular port that hasfailed, and the like.

The acknowledge field may include one or more initials of an operatorthat has acknowledged a particular alarm. The active and most recentalarm windows 505 and 510 may include other fields (not shown) that aida network operator in managing or troubleshooting a network, such asnetwork 110.

The active alarm window 505 provides the operator with a listing ofactive alarms. As new alarms occur in the network 110, the older alarmsare scrolled out of the window 505. Through the use of the scroll bar,the operator may view alarms that have scrolled out of the window 505.

The most recent alarm window 510 displays the most recent alarms in thenetwork 110. The number of most recent alarms displayed may beconfigured by the operator. When monitoring large networks with highalarm volume, the most recent alarm window 510 ensures that criticalalarms (e.g., outages) always show up in the visible area on theoperator's screen. Conventional troubleshooting techniques typicallyhave a single active workspace, such as window 505, to view alarms andact on them. It is likely that the newly arrived alarm will getscrolled-off from the visible area in the window, as operators areworking on alarms that already exist in the window.

If an operator wants to act on a new alarm immediately upon arrival(e.g., acknowledge it), the operator can select the alarm row in themost recent alarm window 510 and the same alarm instance isautomatically selected in the active alarm window 505. The operator maythen proceed to acknowledge the alarm in the active alarm window 510.

FIG. 6 illustrates an alternative exemplary graphical user interface 600consistent with the present invention. As illustrated, the graphicaluser interface 600 includes a trouble information matrix that providesan operator with a summary view of each network element in a system,such as system 100. The trouble information matrix 600 may include thefollowing exemplary fields: a network element (NE) field, an identifier(ID) field, an alarms field, a tickets field, a held alarms field, anotes field, an incidents (IN) field, a users (US) field, an escalatedalarms (EA) field, and a last modified field.

The network element field may include one or more identifiers, in theform of one or more words or icons, representing a network element typeand its alarm state. As illustrated, network element types may include,for example, a frame relay (FR) switch, an Asynchronous Transfer Mode(ATM) switch, an Internet Protocol (IP) router, or the like. To readilyidentify the severity of the alarms associated with a particular networkelement, the network element identifiers may be associated with a color.For example, dark red may be used to represent a critical alarm, red maybe used to represent a major alarm, yellow may be used to represent aminor alarm, and blue may be used to represent an informational alarm.When a network element is associated with alarms of differing severity,the network element may be associated with a color indicative of thealarm having the highest severity.

The ID field may include an identifier of the network element. In animplementation consistent with the present invention, the identifier maybe displayed as a CLLI. The alarms field may include informationregarding the states of the alarms associated with a particular networkelement. The alarms field may include a critical state (CR) subfield, amajor state (MAJ) subfield, a minor state (MIN) subfield, aninformational state (INFO) subfield, and a total alarms (TOTAL)subfield. The critical state, major state, minor state, andinformational state subfields may include a value indicative of thenumber of alarms associated with a particular network element that is inthat particular state. The total alarms subfield may include a valueindicative of the total number of alarms associated with a particularnetwork element. As illustrated, the network element ABCDEFG03H isassociated with 130 total alarms, of which 32 are critical, 35 aremajor, 54 are minor, and 9 are informational.

The tickets field may include an indication of the number of outstandingtrouble tickets that are associated with a network element. The heldalarms field may include an indication of the number of outstandingalarms, associated with a network element, that are on hold. The notesfield may include an indication of the number of outstanding notesassociated with a particular network element.

The incidents field may include an indication of the number ofoutstanding incident reports associated with a network element. Theusers field may include an indication of the number of operators thatare currently monitoring the network element. The escalated alarms fieldmay include an indication of the number of alarms associated with aparticular network element that have an escalated status. The lastmodified field may include the date and time of the last time in whichinformation for a particular network element has been modified.

The trouble information matrix 600 provides an operator with the statusof events associated with selected network elements and allows theoperator to quickly access information in a way not available inconventional systems. For example, selecting a network element in thenetwork element field or on one of the numbers in the alarm field, theoperator may be taken to the active alarm interface 500 where an alarmmay be acknowledged or acted upon. An operator may select a networkelement or alarm number by, for example, by a left-click or double-clickoperation. By selecting a number in the tickets field, the operator maybe provided, via, for example, a trouble ticket viewer, with a moredetailed view of the trouble tickets associated with a particularnetwork element.

By selecting a number in the held alarms field, the operator may betaken to a more detailed view of the alarms that are currently on holdfor a particular network element. Similarly, by selecting a number inthe notes field, the operator may be taken to a notes viewer in whichthe operator can read the notes associated with a particular networkelement. More detailed views of the information in the users andescalated alarms fields may be obtained by selecting a number in thosefields. For example, an operator may be provided with a list of namesand contact information for users that are monitoring a particularnetwork node by selecting the users number in the users field.

FIG. 7 illustrates another exemplary graphical user interface 700consistent with the present invention. In FIG. 7, the graphical userinterface 700 includes a geographical map 710 that illustrates points ofpresence and individual network elements according to their geographicallocation. The graphical user interface 700 also visually mapsoutstanding trouble tickets to objects displayed in the geographical map710. If a particular point of presence has outstanding trouble ticketson any network elements housed therein, a small “T” icon may bedisplayed next to the point of presence icon.

By selecting a particular point of presence or network element that isassociated with a trouble ticket, the graphical user interface 700 mayprovide an operator with a number of options. In one option, thegraphical user interface 700 may provide the operator with a moredetailed view 720 of the geographical area affected. The operator mayalso be provided with a “Show Trouble Tickets” menu that allows fortrouble tickets to be viewed in a trouble ticket management system ofthe operator's choice (e.g., Remedy). Similar viewing options may beprovided for individual network elements as users “drill down” into apoint of presence by selecting the point of presence on the geographicalmap 710.

FIG. 8 illustrates yet another exemplary graphical user interface 800consistent with the present invention. In FIG. 8, the graphical userinterface 800 allows an operator to visualize and navigate a network,such as network 110, in three dimensions. The graphical user interface800 may, for example, be provided as a standard Web browser virtualreality modeling language (VRML) plug-in.

The graphical user interface 800 includes a network topology window 810,navigation tools 820, and management tools 830. In the network topologywindow 810, the network may be broken down into a group of logicalnetwork planes (e.g., Switching planes, Transmission planes, Signalingplanes, Customer Access planes, etc.). This provides a network operatorwith a convenient way to analyze a particular portion of the network ofinterest to that operator.

The network topology window 810 also illustrates how the individuallogical planes and the network elements within those planes areinterconnected. A network operator of the system may for example, definethe logical planes and the association between planes and networkelements. Network elements displayed in the network topology window 810may be colored according to the their alarm status in real-time. Bydisplaying the alarm status of network elements in the network and theinterconnection of those network elements to other network elements inthe network 110, network operators may quickly determine problem areasand how they affect the rest of the network 110.

The navigation tools 820 allow a network operator to “walk” the networkin the network topology window 810. The operator may zoom in and out inorder to get a closer or more distant view of the network, rotate thelogical planes in the network, and the like.

The management tools 830 include a NetPlanes button, a Deselect button,a LiveAlarms button, an AlarmMatrix button, a PerfGraph button, a Tracebutton, and a Quit button. The NetPlanes button allows for differentlogical planes to be toggled in and out of the network topology window810. The operator may select one or more network elements in the networktopology window 810 by, for example, clicking on them. The Deselectbutton allows for selected network elements to be deselected. As in moretraditional two-dimensional network topology displays, an operator mayselect network elements in 3D space and invoke operations on them oropen other informational and real-time windows by clicking on the“LiveAlarms,” “AlarmMatrix,” or “PerfGraph” buttons. By selecting anetwork element on one plane and clicking on the “Trace” button, all“affected” network elements and links on other planes and links betweenplanes will be highlighted. The “Quit” button exits the 3D view andreturns to a login screen.

Unlike standard two-dimensional map representations of networktopologies, the graphical user interface 800 offers the following uniqueadvantages. The network topology window 810 automatically controls thelevel of detail of displayed information. For example, as operators“walk the network,” the labels for network elements in the currentlocale of the operator's view get displayed automatically. This allowsfor uncluttered displays of large network data sets with only relevantinformation shown in greater detail.

The network topology window 810 allows operators to visualize networktopology more naturally. The network topology window 810 showsrelationships between logical layers of the network and helps operatorsvisually relate faults to network topology faster. Once a problem isisolated to a particular network layer, an operator can further focus onnetwork elements on this layer and turn off displaying other layers.

Unlike conventional network displays, operators can stay within thecontext of a single web browser frame as they navigate the network. Theydo not have to “pop-up” numerous windows on the desktop to “drill downthe network” (e.g., going from a customer circuit view into the SONETring that carries that circuit).

Exemplary Processing

FIG. 9 illustrates an exemplary process, consistent with the presentinvention, to improve management of a network, such as network 110.Processing may begin with a user (e.g., a network engineer) initializinga management process at the network operations center 140 [act 905].This initialization procedure may involve the user double-clicking anicon on a screen at the network operations center 140, typing in acommand, or some other well-known technique. The initializationprocedure may also involve some type of well-known log-in process bywhich the user may enter an identifier and password that areauthenticated by the network operations center 140.

The network operations center 140 may then provide a menu of possiblenetwork management options [act 910]. FIG. 10 illustrates an exemplarygraphical user interface 1000 that may be provided to the user ofnetwork operations center 140. As illustrated, the graphical userinterface 1000 requests the selection of a network management option.The options may include a network element management option, a troubleinformation matrix option, a geomap-integrated trouble view option, anda three-dimensional (3D) network topology management option.

Assume that the user selects the network element management option [act920]. The network operations center 140 may request the user to providethe identity a network element of interest [act 922]. Upon entry of anetwork element identifier, the network operations center 140 mayrequest information about the network element from the server 130 [act924]. In response, the server 130 may transmit information, for example,from database 310, that pertains to the requested network element [act926].

Upon receipt of the information from server 130, the network operationscenter 140 may provide the user with the requested information [act928]. The information may be provided, for example, via the graphicaluser interface 500 illustrated in FIG. 5. As illustrated therein, thegraphical user interface 500 may provide the user with detailed alarminformation for a particular network element (e.g., ABCDEFG03H). Theuser may monitor alarms associated with the requested network element inan active alarm window 505. The user may also monitor alarms that havemost recently occurred in a most recent alarms window 510. The user mayuse the graphical user interface 500 to manage the network [act 960].

Assume that the user selects the trouble information matrix option [act930]. Upon the selection of the trouble information matrix option, thenetwork operations center 140 may request current network informationfrom the server 130 [act 932]. In response, the server 130 may transmitinformation from database 330 and/or database 310 to the networkoperations center 140 [act 934].

Upon receipt of the information from server 130, the network operationscenter 140 may provide the user with the requested information [act936]. The information may be provided, for example, via the graphicaluser interface 600 illustrated in FIG. 6. As illustrated therein, thegraphical user interface 600 may provide the user with a summary view ofthe state of each network element in the network. This allows the userto readily determine the number of alarms associated with a particularnetwork element and the severity of those alarms. The graphical userinterface 600 simplifies management of large-scale telecommunicationsnetworks by allowing the user to quickly retrieve detailed informationabout any network element in the network. The user may use the graphicaluser interface 600 to manage the network [act 960].

Assume that the user selects the geomap-integrated trouble view option[act 940]. Upon the selection of the geomap-integrated trouble viewoption, the network operations center 140 may request current networkinformation from the server 130 [act 942]. In response, the server 130may transmit information from database 330 and/or database 310 to thenetwork operations center 140 [act 944].

Upon receipt of the information from server 130, the network operationscenter 140 may provide the user with the requested information [act946]. The information may be provided, for example, via the graphicaluser interface 700 illustrated in FIG. 7. As illustrated therein, thegraphical user interface 700 may provide the user with geographiclocations of points of presence and network elements in the network. Thegraphical user interface 700 may also map trouble tickets to objects inthe network. The user may readily determine the geographic location ofalarms in the network. The user may use the graphical user interface 700to manage the network [act 960].

Assume that the user selects the 3D network topology option [act 950].Upon the selection of the 3D network topology option, the networkoperations center 140 may request current network information from theserver 130 [act 952]. In response, the server 130 may transmitinformation from database 330 and/or database 310 to the networkoperations center 140 [act 954].

Upon receipt of the information from server 130, the network operationscenter 140 may provide the user with the requested information [act956]. The information may be provided, for example, via the graphicaluser interface 800 illustrated in FIG. 8. As illustrated therein, thegraphical user interface 800 may provide the user with a real-time,three-dimensional model of the network. Network elements in the modelmay be shaded in order to depict current states of the network elements.The graphical user interface 800 provides the user with the ability tonavigate through the network, to represent the network as a logicallayer of planes (e.g., customer access, switching, transmission, etc.),and to readily determine how a particular alarm affects the overallnetwork. The user may use the graphical user interface 800 to manage thenetwork [act 960].

CONCLUSION

Systems and methods, consistent with the present invention, provide amechanism to improve network management. The mechanism provides a user(e.g., a network engineer) with several graphical user interfaces withwhich to manage network operations. The graphical user interfaces allowthe user to easily assimilate a large amount of information therebyfacilitating the management of any sized network.

The foregoing description of exemplary embodiments of the presentinvention provides illustration and description, but is not intended tobe exhaustive or to limit the invention to the precise form disclosed.Modifications and variations are possible in light of the aboveteachings or may be acquired from practice of the invention. Forexample, the described implementation includes software and hardware,but elements of the present invention may be implemented as acombination of hardware and software, in software alone, or in hardwarealone. Also, while a series of steps has been described with regard toFIG. 9, the order of the steps may be varied in other implementationsconsistent with the present invention. No element, step, or instructionused in the description of the present application should be construedas critical or essential to the invention unless explicitly described assuch.

The scope of the invention is defined by the following claims and theirequivalents.

1. A method for managing a network having a plurality of network devices, comprising: associating events in the network with one of the plurality of network devices; providing a geographical map, the geographical map displaying locations of each of the plurality of network devices and indicating which of the plurality of network devices are associated with at least one event; and managing the network using the geographical map.
 2. The method of claim 1 wherein the network devices include points of presence and network elements.
 3. The method of claim 1 further comprising: selecting a network device having at least one associated event; and providing information regarding the at least one associated event.
 4. The method of claim 1 wherein the geographical map further displays a state of each network device.
 5. A device for managing a network having a plurality of network devices, comprising: a memory configured to store instructions; and a processor configured to execute the instructions to associate an event in the network with a network device and provide a geographical map, the geographical map displaying locations of network devices and indicating which network devices are associated with at least one event.
 6. The device of claim 5 wherein the network devices include points of presence and network elements.
 7. The device of claim 5 wherein the processor is further configured to: provide event information in response to selection of a network device having at least one event associated therewith.
 8. The device of claim 5 wherein the processor is further configured to: display a state of each network device on the geographical map.
 9. A computer-readable medium containing instructions for controlling at least one processor to perform a method for managing a network having a plurality of network devices, the method comprising: associating events in the network with one of the plurality of network devices; providing a geographical map, the geographical map displaying locations of each of the plurality of network devices and indicating which of the plurality of network devices are associated with at least one event; and managing the network using the geographical map.
 10. The computer-readable medium of claim 9 wherein the network devices include points of presence and network elements.
 11. The computer-readable medium of claim 9 wherein the method further comprises: selecting a network device having at least one associated event; and providing information regarding the at least one associated event.
 12. The computer-readable medium of claim 9 wherein the geographical map further displays a state of each network device.
 13. A device for managing a network having a plurality of network elements, comprising: a memory configured to store instructions; and a processor configured to execute the instructions to associate each network element with one of a plurality of logical planes and provide a network map, the network map displaying relationships between the plurality of logical planes and those network elements associated with the plurality of logical planes.
 14. The device of claim 13 wherein the plurality of logical planes includes one or more of a transmission plane, a switching plane, a customer access plane, and a signaling plane.
 15. The device of claim 13 wherein the processor is further configured to: allow a user to navigate through the network map.
 16. The device of claim 13 wherein the processor is further configured to: display a state of each network element in the network map.
 17. The device of claim 13 wherein the network map is a three-dimensional network map.
 18. A method for managing a network having a plurality of network elements, comprising: associating each of the plurality of network elements with one of a plurality of logical planes; providing a network map, the network map displaying relationships between the plurality of logical planes and those network elements associated with the plurality of logical planes; and managing the network using the network map.
 19. The method of claim 18 wherein the plurality of logical planes includes one or more of a transmission plane, a switching plane, a customer access plane, and a signaling plane.
 20. The method of claim 18 wherein the managing includes: allowing a user to navigate through the network map.
 21. The method of claim 18 wherein the providing includes: displaying a state of each network element in the network map.
 22. The method of claim 18 wherein the network map is a three-dimensional network map.
 23. A computer-readable medium containing instructions for controlling at least one processor to perform a method for managing a network having a plurality of network elements, the method comprising: associating each of the plurality of network elements with one of a plurality of logical planes; providing a network map, the network map displaying relationships between the plurality of logical planes and those network elements associated with the plurality of logical planes; and managing the network using the network map.
 24. A system for managing a network having a plurality of network elements, comprising: a user device configured to provide a user with a list of network management options, the options including a network element diagnostic option, a network summary option, a geographical network management option, a three-dimensional network management option, transmit, in response to a selection of an option by the user, a request for current network information, provide the user with current network information according to the selected option; and a server configured to receive the request for current network information and transmit current network information to the user device.
 25. The system of claim 24 wherein the user device is configured to: provide, in response to a selection of the network element diagnostic option, a first list of events occurring in the network, and simultaneously provide a second list of events occurring in the network, the second list comprising a predetermined number of most recent events.
 26. The system of claim 24 wherein the user device is configured to: provide, in response to a selection of the network summary option, a list of network element identifiers associated with the plurality of network elements, each network element identifier being associated with a state indication.
 27. The system of claim 24 wherein the user device is configured to: associate, in response to a selection of the geographical network management option, events in the network with one of the plurality of network devices, and provide a geographical map, the geographical map displaying locations of each of the plurality of network devices and indicating which of the plurality of network devices are associated with at least one event.
 28. The system of claim 24 wherein the user device is configured to: associate, in response to a selection of the three-dimensional network management option, each of the plurality of network elements with one of a plurality of logical planes, and provide a network map, the network map displaying relationships between the plurality of logical planes and those network elements associated with the plurality of logical planes. 